General Data Protection Regulation (GDPR)
The short answer · 14 words
In short
European Regulation on the standardisation of the protection of personal data of natural persons.
Flow-alerta.cab (2026): General Data Protection Regulation (GDPR). https://flow-alerta.cab/en/glossar/dsgvo. Editorially reviewed on: 09 October 2026.
How much detail would you like?
Practical
Relevant, if personal data are processed within the scope of the GDPR; not lump sum for every use of software.
Possible example: A company documents the legal basis and deletion periods for contact form data, informs those affected and checks the service providers used.
Data protection-compliant websites, CRM systems, HR processes and contractual protection of service providers in medium-sized companies.
At a glance
- Core
- The GDPR regulates the processing of personal data in the EU. It enshrines principles such as data minimisation, purpose limitation, transparency and data subject rights (right of access, deletion) and threatens sensitive fines in the event of breaches.
- Use
- Relevant, if personal data are processed within the scope of the GDPR; not lump sum for every use of software.
- Example
- Possible example: A company documents the legal basis and deletion periods for contact form data, informs those affected and checks the service providers used.
- Limits
- No suitable legal basis; unnecessary data collection; unclear deletion periods; missing contracts in the case of order processing; leaving third-country transfers unchecked.
In context
Questions about this term
Is Consent Always Needed?
No. Article 6 specifies further legal bases, such as performance of the contract or legitimate interests under the respective conditions.
Are business email addresses personal?
Personal addresses such as firstname.lastname@firma.de may be included.
All details and background
The GDPR regulates the processing of personal data in the EU. It enshrines principles such as data minimisation, purpose limitation, transparency and data subject rights (right of access, deletion) and threatens sensitive fines in the event of breaches.
ELI5 – Explained simply
Rules apply to personal data: companies need a permissible reason for processing and must respect people’s rights. Consent is a possible legal basis, but not the only one.
Why it matters in practice
Relevant, if personal data are processed within the scope of the GDPR; not lump sum for every use of software.
Example
Possible example: A company documents the legal basis and deletion periods for contact form data, informs those affected and checks the service providers used.
Pitfalls and limits
- No suitable legal basis; unnecessary data collection; unclear deletion periods; missing contracts in the case of order processing; leaving third-country transfers unchecked.
Origin & history
Adopted in 2016, mandatory since 25 May 2018 in all EU Member States.
Use in mid-sized companies
- Data protection-compliant websites, CRM systems, HR processes and contractual protection of service providers in medium-sized companies.
Related terms
Matching Flow-alerta service
AI adoption & supportWebsites & web applications; AI implementation & support – technical implementation of specified data protection requirementsMatching tool / use case
View use casesUse Case: Document data flows, access and deletion for a contact form and implement tested requirements accordingly.Sources
- eur-lex.europa.euVerordnung (EU) 2016/679, insbesondere Artikel 3, 5, 6 und 28
Quellen geprüft am 09.10.2026.
Editorially reviewed on: